hsjsstn opened a new issue, #398: URL: https://github.com/apache/dubbo-go-hessian2/issues/398
<!-- Please use this template while reporting a bug and provide as much info as possible. Not doing so may result in your bug not being addressed in a timely manner. Thanks! --> **What happened**: While looking through the decoder implementation, I noticed what looks like a bug. It seems that a malformed typed list can cause the decoder to panic instead of returning an error. **What you expected to happen**: I expected the decoder to return an error for malformed input instead of panicking. **How to reproduce it (as minimally and precisely as possible)**: I haven’t prepared a minimal PoC yet, but from reading the code the execution flow appears to be: Decode() → DecodeValue() → readTypedListValue() → SetValue() / ConvertSliceValueType() Using a malformed Hessian payload where the typed list declaration and the actual element type do not match seems to trigger this path. **Anything else we need to know?**: I haven’t confirmed whether this is an intended behavior, but it seemed worth reporting since malformed input appears to cause a panic rather than an error. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
